#Clone the event
clone {id => "REMEDY_TRANS_CLONE" clones => ["new-type"]}}
#Clean up the event you want stripped down and sent to new index
if [type] == "new-type" { #Use prune to remove all fields but the ones you want
prune { whitelist_names => [] } #Repalce your index value with the new destination
mutate { replace => { "[@metadata][index]" => "vnfsdb-20181214" } }
}
output{
{
.....
index => "%{[@metadata][index]}"
}
}
Where is the counter value coming from? If you control the document_id you are sending to you can avoid scripting and just update the field with whatever value gets applied in the pipeline. Preserve your id field in the prune whitelist and apply to the document_id => "%{..}" in the output with your update action. Now if you are incrementing every time that document is updated you would need to leverage scripting if the count isn't already in your document. Something like:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.